feat(api): finish Group A stubbed endpoints

Implements previously-stubbed /api/v1 endpoints (hexagonal: ports -> repos
-> services -> routers wired in deps):

- playlists: GET /{id}/cover (serves stored cover, 404 when absent)
- settings: GET/PATCH /settings + GET/PUT /settings/scrobbling — lazy
  per-user row, write-only Fernet-encrypted scrobble session key; adds
  user_settings table + migration (chains off dc126696f5a6)
- storage: GET /duplicates, /broken, /missing-metadata + admin POST
  /cleanup (arq cleanup_storage worker; reconciles local refs only,
  guarded against a storage-outage mass delete)
- admin: GET /services, /sources, /settings + POST /reindex; PATCH
  /settings and /sources/{source} return 501 (config is env-managed)

Adds NotSupportedError (-> HTTP 501). Integration tests for each surface.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/infrastructure/sources/registry.py

@@ -48,6 +48,10 @@ class SourceRegistry:
         """Every registered source that supports search (for cross-source search)."""
         return [cast(SearchableSource, b) for b in self._by_name.values() if hasattr(b, "search")]
 
+    def indexables(self) -> list[IndexableSource]:
+        """Every registered source that can be indexed (for a full re-scan)."""
+        return [cast(IndexableSource, b) for b in self._by_name.values() if hasattr(b, "scan")]
+
     def infos(self) -> list[SourceInfo]:
         return [backend.info() for backend in self._by_name.values()]